A heap‑based buffer overflow exists in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code. The flaw is triggered when processing a manipulated Word document, resulting in the ability to run code with the privileges of the user who opens the file. This type of vulnerability falls under the buffer overflow flaw list and can compromise confidentiality, integrity, or availability of the affected system if exploited.

The vulnerability affects Microsoft Office products including Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Specific version information is not provided in the advisory, so all editions of the listed products that include the vulnerable code are considered at risk.

The CVSS score of 8.8 categorizes this flaw as high severity. Although a publicly available EPSS score is not listed, the lack of a KEV designation does not preclude the potential for exploitation. The likely attack vector is network‑based, whereby an attacker can embed a malicious document and deliver it over a shared drive or via email. Attackers can achieve remote code execution once the targeted document is opened, making this a serious threat especially in environments that enable users to open documents from untrusted sources.